Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\@please_read_me@.txt
- <Drive name for removable media>:\@wanadecryptor@.exe
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\13.jpg
- %HOMEPATH%\desktop\168.jpg
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\3.jpg
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpg
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\pushkin.jpeg
- %HOMEPATH%\desktop\region-north-karelia.jpeg
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\join.avi
Modifies file system
Creates the following files
- %TEMP%\deformclient.exe
- %TEMP%\b.wnry
- %TEMP%\c.wnry
- %TEMP%\msg\m_bulgarian.wnry
- %TEMP%\msg\m_chinese (simplified).wnry
- %TEMP%\msg\m_chinese (traditional).wnry
- %TEMP%\msg\m_croatian.wnry
- %TEMP%\msg\m_czech.wnry
- %TEMP%\msg\m_danish.wnry
- %TEMP%\msg\m_dutch.wnry
- %TEMP%\msg\m_english.wnry
- %TEMP%\msg\m_filipino.wnry
- %TEMP%\msg\m_finnish.wnry
- %TEMP%\msg\m_french.wnry
- %TEMP%\msg\m_german.wnry
- %TEMP%\msg\m_greek.wnry
- %TEMP%\msg\m_indonesian.wnry
- %TEMP%\msg\m_italian.wnry
- %TEMP%\msg\m_japanese.wnry
- %TEMP%\msg\m_korean.wnry
- %TEMP%\msg\m_latvian.wnry
- %TEMP%\msg\m_norwegian.wnry
- %TEMP%\msg\m_polish.wnry
- %TEMP%\msg\m_portuguese.wnry
- %TEMP%\msg\m_romanian.wnry
- %TEMP%\msg\m_russian.wnry
- %TEMP%\msg\m_slovak.wnry
- %TEMP%\msg\m_spanish.wnry
- %TEMP%\msg\m_swedish.wnry
- %TEMP%\msg\m_turkish.wnry
- %TEMP%\msg\m_vietnamese.wnry
- %TEMP%\r.wnry
- %TEMP%\s.wnry
- %TEMP%\t.wnry
- %TEMP%\taskdl.exe
- %TEMP%\taskse.exe
- %TEMP%\u.wnry
- %TEMP%\00000000.pky
- %TEMP%\00000000.eky
- %TEMP%\00000000.res
- %TEMP%\@wanadecryptor@.exe
- %TEMP%\131241769182715.bat
- %TEMP%\@please_read_me@.txt
- %HOMEPATH%\desktop\13.jpg.wncryt
- %HOMEPATH%\desktop\168.jpg.wncryt
- %HOMEPATH%\desktop\2.jpeg.wncryt
- %HOMEPATH%\desktop\3.jpg.wncryt
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpg.wncryt
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncryt
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncryt
- %HOMEPATH%\desktop\nwfieldnotes1966.docx.wncryt
- %HOMEPATH%\desktop\ovp25012015.doc.wncryt
- %HOMEPATH%\desktop\parnas_01.jpeg.wncryt
- %HOMEPATH%\desktop\pushkin.jpeg.wncryt
- %TEMP%\m.vbs
- %HOMEPATH%\desktop\region-north-karelia.jpeg.wncryt
- %HOMEPATH%\desktop\sdszfo.docx.wncryt
- %HOMEPATH%\desktop\@please_read_me@.txt
- %HOMEPATH%\desktop\@wanadecryptor@.exe
- %TEMP%\f.wnry
- %TEMP%\@wanadecryptor@.exe.lnk
- C:\@please_read_me@.txt
- C:\@wanadecryptor@.exe
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\@please_read_me@.txt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\@wanadecryptor@.exe
- C:\recovery\windowsre\@please_read_me@.txt
- C:\recovery\windowsre\@wanadecryptor@.exe
- %ALLUSERSPROFILE%\microsoft\appv\setup\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\appv\setup\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\diagnosis\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\network\downloader\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\network\downloader\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\uev\scripts\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\uev\scripts\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\user account pictures\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\user account pictures\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\windows\caches\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\windows\caches\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\@wanadecryptor@.exe.lnk
- %ALLUSERSPROFILE%\microsoft\windows nt\msscan\@please_read_me@.txt
- %ALLUSERSPROFILE%\microsoft\windows nt\msscan\@wanadecryptor@.exe.lnk
- %LOCALAPPDATA%\@please_read_me@.txt
- %LOCALAPPDATA%\@wanadecryptor@.exe.lnk
- %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_11[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_13[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_14[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_15[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_16[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_17[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_18[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_19[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_21[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_22[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_23[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_25[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_28[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_29[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_3[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_4[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_5[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_6[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_7[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_8[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_9[1].txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.0.filtertrie.intermediate.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.0.filtertrie.intermediate.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsconversions.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appssynonyms.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsconversions.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsglobals.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingssynonyms.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.0.filtertrie.intermediate.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.0.filtertrie.intermediate.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678985908530147.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986116913057.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986733179726.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678987880972005.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678989939868207.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678992605195845.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678993617257337.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994176510543.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994514315348.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678997188779717.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998364928099.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998646131207.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999296595607.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999588120541.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000033359704.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000600569277.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000729483910.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679004887860863.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679006410337295.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679008721437407.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\settingscache.txt.wncryt
- %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.wncryt
- %ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.wncryt
- %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.wncryt
- %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlskey.der.wncryt
- %APPDATA%\microsoft\templates\normal.dotm.wncryt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.wncryt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.wncryt
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.wncryt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.wncryt
- %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.wncryt
- %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.wncryt
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.wncryt
- %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlscert.der.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.1.filtertrie.intermediate.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.2.filtertrie.intermediate.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.1.filtertrie.intermediate.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.2.filtertrie.intermediate.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.1.filtertrie.intermediate.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.2.filtertrie.intermediate.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.1.filtertrie.intermediate.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.2.filtertrie.intermediate.txt.wncryt
- %LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\logfile_august_11_2024__6_41_11.txt.wncryt
- %APPDATA%\microsoft\templates\~$normal.dotm.wncryt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.wncryt
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.wncryt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\alternateservices.txt.wncryt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.wncryt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\securitypreloadstate.txt.wncryt
- %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sitesecurityservicestate.txt.wncryt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.wncryt
- C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.wncryt
- C:\recovery\windowsre\winre.wim.wncryt
- %ALLUSERSPROFILE%\desktop\@wanadecryptor@.bmp
- %ALLUSERSPROFILE%\desktop\@wanadecryptor@.exe
- C:\users\default\desktop\@wanadecryptor@.bmp
- C:\users\default\desktop\@wanadecryptor@.exe
- C:\users\default user\desktop\@wanadecryptor@.bmp
- C:\users\default user\desktop\@wanadecryptor@.exe
- C:\users\public\desktop\@wanadecryptor@.bmp
- C:\users\public\desktop\@wanadecryptor@.exe
- %HOMEPATH%\desktop\@wanadecryptor@.bmp
- %TEMP%\hibsys.wncryt
- %TEMP%\taskdata\tor\libeay32.dll
- %TEMP%\taskdata\tor\libevent-2-0-5.dll
- %TEMP%\taskdata\tor\libevent_core-2-0-5.dll
- %TEMP%\taskdata\tor\libevent_extra-2-0-5.dll
- %TEMP%\taskdata\tor\libgcc_s_sjlj-1.dll
- %TEMP%\taskdata\tor\libssp-0.dll
- %TEMP%\taskdata\tor\ssleay32.dll
- %TEMP%\taskdata\tor\tor.exe
- %TEMP%\taskdata\tor\zlib1.dll
- %TEMP%\taskdata\tor\taskhsvc.exe
- %APPDATA%\tor\state.tmp
Deletes following files that it created itself
- %TEMP%\deformclient.exe
Moves the following files
- from %HOMEPATH%\desktop\13.jpg.wncryt to %HOMEPATH%\desktop\13.jpg.wncry
- from %HOMEPATH%\desktop\168.jpg.wncryt to %HOMEPATH%\desktop\168.jpg.wncry
- from %HOMEPATH%\desktop\2.jpeg.wncryt to %HOMEPATH%\desktop\2.jpeg.wncry
- from %HOMEPATH%\desktop\3.jpg.wncryt to %HOMEPATH%\desktop\3.jpg.wncry
- from %HOMEPATH%\desktop\4f0bf7ff71f28.jpg.wncryt to %HOMEPATH%\desktop\4f0bf7ff71f28.jpg.wncry
- from %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncryt to %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncry
- from %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncryt to %HOMEPATH%\desktop\file_p_00000000_1371597592.docx.wncry
- from %HOMEPATH%\desktop\nwfieldnotes1966.docx.wncryt to %HOMEPATH%\desktop\nwfieldnotes1966.docx.wncry
- from %HOMEPATH%\desktop\ovp25012015.doc.wncryt to %HOMEPATH%\desktop\ovp25012015.doc.wncry
- from %HOMEPATH%\desktop\parnas_01.jpeg.wncryt to %HOMEPATH%\desktop\parnas_01.jpeg.wncry
- from %HOMEPATH%\desktop\pushkin.jpeg.wncryt to %HOMEPATH%\desktop\pushkin.jpeg.wncry
- from %HOMEPATH%\desktop\region-north-karelia.jpeg.wncryt to %HOMEPATH%\desktop\region-north-karelia.jpeg.wncry
- from %HOMEPATH%\desktop\sdszfo.docx.wncryt to %HOMEPATH%\desktop\sdszfo.docx.wncry
- from %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.wncryt to %LOCALAPPDATA%\microsoft\internet explorer\brndlog.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\diagoutputdir\skypeapp0.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_10[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_11[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_11[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_12[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_13[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_13[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_14[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_14[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_15[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_15[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_16[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_16[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_17[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_17[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_18[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_18[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_19[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_19[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_20[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_21[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_21[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_22[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_22[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_23[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_23[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_24[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_25[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_25[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_26[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_27[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_28[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_28[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_29[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_29[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_2[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_3[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_3[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_4[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_4[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_5[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_5[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_6[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_6[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_7[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_7[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_8[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_8[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_9[1].txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\appcache\dfgt9a84\1\c__windows_systemapps_microsoft.windows.search_cw5n1h2txyewy_cache_desktop_9[1].txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.0.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.0.filtertrie.intermediate.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.0.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.0.filtertrie.intermediate.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsconversions.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsconversions.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appsglobals.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appssynonyms.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\appssynonyms.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsconversions.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsconversions.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsglobals.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingsglobals.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingssynonyms.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\input_{64c6d362-453e-4f77-ac86-adaf4fc0bc55}\settingssynonyms.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.0.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.0.filtertrie.intermediate.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.0.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.0.filtertrie.intermediate.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678985908530147.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678985908530147.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986116913057.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986116913057.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986733179726.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678986733179726.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678987880972005.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678987880972005.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678989939868207.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678989939868207.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678992605195845.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678992605195845.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678993617257337.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678993617257337.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994176510543.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994176510543.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994514315348.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678994514315348.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678997188779717.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678997188779717.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998364928099.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998364928099.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998646131207.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678998646131207.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999296595607.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999296595607.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999588120541.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133678999588120541.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000033359704.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000033359704.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000600569277.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000600569277.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000729483910.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679000729483910.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679004887860863.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679004887860863.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679006410337295.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679006410337295.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679008721437407.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\appcache133679008721437407.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\settingscache.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\devicesearchcache\settingscache.txt.wncry
- from %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.wncryt to %ALLUSERSPROFILE%\microsoft\appv\setup\officeintegrator.ps1.wncry
- from %ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.wncryt to %ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\welcomefax.tif.wncry
- from %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.wncryt to %LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.wncry
- from %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlskey.der.wncryt to %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlskey.der.wncry
- from %APPDATA%\microsoft\templates\normal.dotm.wncryt to %APPDATA%\microsoft\templates\normal.dotm.wncry
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.wncryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js.wncry
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.wncryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\user.js.wncry
- from %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.wncryt to %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\user.js.wncry
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\prefs.js.wncry
- from %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.wncryt to %ALLUSERSPROFILE%\microsoft\diagnosis\osver.txt.wncry
- from %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.wncryt to %ALLUSERSPROFILE%\microsoft\uev\scripts\registerinboxtemplates.ps1.wncry
- from %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.wncryt to %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.wncry
- from %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlscert.der.wncryt to %LOCALAPPDATA%\packages\microsoft.skypeapp_kzf8qxf38zg5c\localstate\dtlscert.der.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.1.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.1.filtertrie.intermediate.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.2.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{57061e4e-1e16-4c61-b18c-11c132e74233}\0.2.filtertrie.intermediate.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.1.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.1.filtertrie.intermediate.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.2.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\apps_{e1d25c92-9e2f-468f-b31e-8ea94f6c0fac}\0.2.filtertrie.intermediate.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.1.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.1.filtertrie.intermediate.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.2.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{b8923a2c-9ca7-4024-b14f-30794afe5664}\0.2.filtertrie.intermediate.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.1.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.1.filtertrie.intermediate.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.2.filtertrie.intermediate.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\localstate\constraintindex\settings_{c962daa5-3c13-4c53-b573-e2ac874a52a3}\0.2.filtertrie.intermediate.txt.wncry
- from %LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\logfile_august_11_2024__6_41_11.txt.wncryt to %LOCALAPPDATA%\packages\microsoft.xboxgameoverlay_8wekyb3d8bbwe\localstate\diagoutputdir\logfile_august_11_2024__6_41_11.txt.wncry
- from %APPDATA%\microsoft\templates\~$normal.dotm.wncryt to %APPDATA%\microsoft\templates\~$normal.dotm.wncry
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.wncryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\pkcs11.txt.wncry
- from %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.wncryt to %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\sitesecurityservicestate.txt.wncry
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\alternateservices.txt.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\alternateservices.txt.wncry
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\pkcs11.txt.wncry
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\securitypreloadstate.txt.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\securitypreloadstate.txt.wncry
- from %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sitesecurityservicestate.txt.wncryt to %APPDATA%\thunderbird\profiles\gbmwccb6.default-release\sitesecurityservicestate.txt.wncry
- from C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.wncryt to C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww.cab.wncry
- from C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.wncryt to C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\propsww2.cab.wncry
- from C:\recovery\windowsre\winre.wim.wncryt to C:\recovery\windowsre\winre.wim.wncry
- from %APPDATA%\tor\state.tmp to %APPDATA%\tor\state
Modifies the following files
- %HOMEPATH%\desktop\13.jpg
- %HOMEPATH%\desktop\168.jpg
- %HOMEPATH%\desktop\2.jpeg
- %HOMEPATH%\desktop\3.jpg
- %HOMEPATH%\desktop\4f0bf7ff71f28.jpg
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\parnas_01.jpeg
- %HOMEPATH%\desktop\pushkin.jpeg
- %HOMEPATH%\desktop\region-north-karelia.jpeg
- %HOMEPATH%\desktop\sdszfo.docx
- %APPDATA%\microsoft\windows\themes\transcodedwallpaper
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'localhost':9050
- 'localhost':49693
- '85.##4.206.219':9001
- '17#.#5.193.9':80
- '21#.#9.179.177':9001
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'Wana Decrypt0r 2.0'
Creates and executes the following
- '%TEMP%\deformclient.exe'
- '%TEMP%\taskdl.exe'
- '%TEMP%\@wanadecryptor@.exe' co
- '%TEMP%\@wanadecryptor@.exe' vs
- '%TEMP%\taskdata\tor\taskhsvc.exe'
- '%TEMP%\taskse.exe' %TEMP%\@WanaDecryptor@.exe
- '%TEMP%\@wanadecryptor@.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del "<Full path to file>" > nul
- '%WINDIR%\syswow64\attrib.exe' +h .
- '%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q
- '%WINDIR%\syswow64\cmd.exe' /c 131241769182715.bat
- '%WINDIR%\syswow64\cscript.exe' //nologo m.vbs
- '%WINDIR%\syswow64\attrib.exe' +h +s D:\$RECYCLE
- '%WINDIR%\syswow64\cmd.exe' /c start /b @WanaDecryptor@.exe vs
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "fxkkvogtpzwn131" /t REG_SZ /d "\"%TEMP%\tasksche.exe\"" /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "fxkkvogtpzwn131" /t REG_SZ /d "\"%TEMP%\tasksche.exe\"" /f
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...
- '%TEMP%\deformclient.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del "<Full path to file>" > nul' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +h .' (with hidden window)
- '%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q' (with hidden window)
- '%TEMP%\taskdl.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c 131241769182715.bat' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +h +s D:\$RECYCLE' (with hidden window)
- '%TEMP%\@wanadecryptor@.exe' co' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c start /b @WanaDecryptor@.exe vs' (with hidden window)
- '%TEMP%\taskdata\tor\taskhsvc.exe' ' (with hidden window)
- '%TEMP%\taskse.exe' %TEMP%\@WanaDecryptor@.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "fxkkvogtpzwn131" /t REG_SZ /d "\"%TEMP%\tasksche.exe\"" /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog ...' (with hidden window)
